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The paper presents the design of the pressurization system of the European Service 
Module (ESM) of the Orion Multi-Purpose Crew Vehicle (MPCV). Being part of the 
propulsion subsystem, an electrical pressurization concept is implemented to condition 
propellants according to the engine needs via a bang-bang regulation system. Separate 
pressurization for the oxidizer and the fuel tank permits mixture ratio adjustments and 
prevents vapor mixing of the two hypergolic propellants during nominal operation. In case 
of loss of pressurization capability of a single side, the system can be converted into a 
common pressurization system. The regulation concept is based on evaluation of a set of 
tank pressure sensors and according activation of regulation valves, based on a single-failure 
tolerant weighting of three pressure signals. While regulation is performed on ESM level, 
commanding of regulation parameters as well as failure detection, isolation and recovery 
is performed from within the Crew Module, developed by Lockheed Martin Space System 
Company. The overall design and development maturity presented is post Preliminary 
Design Review (PDR) and reflects the current status of the MPCV ESM pressurization 
system. 


Nomenclature 


AUX 

Auxiliary thrusters 

CM 

Crew Module 

CMA 

Crem Module Adapter 

EPR 

Electrical pressure regulation 

ESA 

European Space Agency 

ESM 

European Service Modue 

FDIR 

Failure detection, isolation and recovery 

iCPS 

interim Cryogenic Propulsion Stage 

LAS 

Launch Abort System 

LOI 

Lunar orbit insertion 

LV 

Latch Valve 

MMH 

Mono-methyl hydrazine 

MON 

Mixed oxides of nitrogen (tetroxides) 
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MPCV 

Multi-Purpose Crew Vehicle 

ODN 

Orion Data Network 

OMS - E 

Orbital maneuvering system engine 

PCA 

Pressure control assembly 

PDE 

Propulsion drive electronics 

PDR 

Preliminary Design Review 

PDU 

Power Distribution Unit 

PRU 

Pressure regulation unit 

PT 

Pressure transducer 

RCS 

Reaction control system 

SA 

Spacecraft Adapter- 

SAJ 

Spacecraft Adaptern Jettisoned Fairings 

SLS 

Space Launch System 

SM 

Service Module 

SV 

Solenoid Valve 

TEI 

Trans-earth injection 


I. Introduction 

T he Orion Multi-Purpose Crew Vehicle (MPCV) is the next generation spacecraft that NASA currently 
developing to send humans and cargo into low earth orbit and beyond and return them back to earth 
safely. The vehicle, which will be launched by the new Space Launch System (SLS), is designed to support 
long-duration deep space missions. The first exploration mission is planned to take place at the end of 
2017 as an uncrewed lunar flyby mission followed by a second exploration mission at the end of 2021 taking 
astronauts to the moon. The second stage of the SLS, the interim Cryogenic Propulsion Stage (iCPS), 
will insert Orion into a lunar trajectory. Orion will use its main engine to place itself into lunar orbit. 
Orion must maintain attitude control during lunar operations, perform the trans-Earth injection maneuver 
to return from the Moon, and perform entry, descent and landing. 

The MPCV itself resembles its Apollo predeces- 
sors and will consists of the Launch Abort System 
(LAS), the habitable Crew Module (CM) and the 
disposable Service Module (SM). The bulk of what 
makes up the SM is referred to as the European Ser- 
vice Module (ESM), which provides power, life sup- 
port, and in-space propulsion. The SM also includes 
the Crew Module Adapter (CMA), the Spacecraft 
Adapter Jettisoned Fairings (SAJ), and the Space- 
craft Adapter (SA) as shown in Figure 1. 

The MPCVs technology is more advanced and 
with its capability to support up to four crew mem- 
bers for spaceflight missions, it is larger than Apol- 
los Modules. While Lockheed Martin Space Sys- 
tems represents NASAs MPCV Orion US industrial 
prime contractor, the European Service Module is 
developed in partnership with ESA and its indus- 
trial partner Airbus DS GmbH, who is responsible for the design and development. An overview description 
of the European contribution has been provided by Berthe et al. 1 In this paper the electrical pressurization 
system of the ESM propulsion subsystem, which is developed by Airbus DS GmbH in Bremen, Germany, 
is presented. After a short description of the overall propulsion subsystem the layout and the functional 
design of the pressurization system is presented in more detail. Furthermore, a description of the operational 
logic and implementation of a cross feed function is provided. The paper closes with a short summary and 
conclusions about the current design. 
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II. ESM Propulsion System 


The ESM propulsion system is designed to provide thrust after separation from the upper stage of the 
SLS to adjust and change the flight trajectory during nominal mission operations. In addition, the ESM shall 
be capable to transfer the crew module into a safe earth orbit after certain launcher failures. The propulsion 
system as part of the ESM given in Figure 2 comprises three different types of engines / thrusters to fulfill 
its tasks. 

• A single main engine (OMS-E), which is a re-use of one of the Space Shuttle’s orbital maneuvering 
system (OMS) engines, with a thrust level of 26.7 kN. The engine is used for ascent abort maneuvers 
and orbit change maneuvers, e.g. for lunar orbit insertion (LOI) or trans-earth injection (TEI). 

• Eight (8) auxiliary (AUX) thrusters, similar to those used on the European ATV, with a thrust level 
of each 490 N. The thrusters are used for ascent abort maneuvers, launcher separation, trajectory 
correction maneuvers, and in addition serve as back-up for the main engine. 

• Twenty-four (24) reaction control system (RCS) thrusters, which correspond to the ones used on ATV, 
with a thrust level of each 220 N. The thrusters, which are accommodated in six pods with each four 
thrusters, are used for translation and attitude control maneuvers 

Each of these thrusters utilises MON-3 as oxi- 
dizer and MMH as fuel at the same nominal mixture 
ratio of 1.65. The propellants are stored in two se- 
rial connected tanks per type. The downstream tub- 
ing towards the engine / thrusters comprises several 
electro-mechanical valves to ensures isolation of the 
engine / thrusters from the propellant tanks during 
launch, docked phase to the ISS and other mission 
events where isolation becomes necessary. For each 
propellant type, the separated pressurization system 
upstream of the propellant tanks mainly consist of 
a high pressure Helium vessels, a pressure control 
assembly (PCA) housing electro-mechanical isola- 
tion and regulation valves and pressure transduc- 
ers, and two shared pressure regulation units (PRU), 
which perform the electrical bang-bang regulation, 
which is described in more detail in the following 
course of this paper. The pressure-fed propulsion 
system is controlled by the Propulsion Drive Elec- 
tronics (PDE) which handles all nominal propulsion 
related commands issued by the CM’s Vehicle Man- 
agement Computer and provides feedback via the 
CM A Power Distribution Units (PDUs). 

III. Pressurization System Design 

To pressurize the propulsion subsystem, an electrical pressurization concept is used on the man-rated 
spacecraft. Separate pressurization for the oxidizer and the fuel tank permits mixture ratio adjustments 
and prevents vapor mixing of the two hypergolic propellants. The pressurization function dispenses helium 
from a 400 bar vessel to replace propellant in the propellant tanks. The pressure in the propellant tanks is 
adaptable and conditioned according to the engine needs via a bang-bang regulation concept, which opens 
and closes high pressure solenoid valves depending on the propellant tank pressure. A similar approach has 
also been suggested and investigated in the past by Lockheed Martin Space Systems. 

In the following subsections a detailed description of the layout of the pressurization system, the under- 
laying regulation concept, and the tank pressure evaluation used to trigger valve activation is given. 



Figure 2. MPCV-ESM Propulsion subsystem 
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III. A. Layout 


To realize the regulation concept, the pressurization system mainly consists of a series of bi-stable high 
pressure gas latch valves (LV), mono-stable high pressure solenoid valves (SV) that are commanded by dedi- 
cated pressure regulation units (PRU), and pressure transducers that measure the propellant tank pressure, 
Figure 3. To limit the Helium mass flow at begin of a mission, when the pressure in the Helium vessels is still 
high, flow limiting orifices are implemented downstream of the regulation valves. For activation and deacti- 
vation of the mono-stable regulation valves, the pressure regulation unit acquires three tank pressure values, 
calculates a weighted average, compares it to a set point, and commands the solenoid valves accordingly. 



The bi-stable high pressure gas latch valves serve as a system required third barrier between the Helium 
vessel and the propellant tank to be two fault tolerant against propellant tank over-pressurization. During 
pressurization phases, these valves remain open and are not involved in the active regulation loop. Thus 
they are directly commanded by the vehicle management computer (VMC) located in the crew module via 
the power distribution units (PDU) on CMA level and propulsion drive electronics (PDE) on ESM level. 

Two mono-stable solenoid valves are implemented in series, which are commanded by the PRU in hot 
redundancy, such that a failed open valve will have no effect on the propellant tank pressure. To identify this 
failure mode, which cannot be monitored via the propellant tank pressure, each solenoid valve is equipped 
with a position indicator in the open position. 

To be single fault tolerant against loss of pressurization, two parallel branches are implemented. During 
active regulation phases, only one branch per propellant side is used for pressurization. In case of loss of 
pressurization, which is detected by a decreasing tank pressure, automatic switching-over to the redundant 
branch is performed within less than one second. 

For pressure monitoring and evaluation, eight propellant tank passive pressure transducers are attached 
to each propellant side. Three pressure transducers are attached to each of the two PRUs, which perform 
regulation of the nominal, and the redundant branch, respectively, based on a weighted average of three 
pressure data inputs. Two additional pressure sensors are connected with the PDE directly to allow pressure 
monitoring during long cruise phases, when the pressure regulation is shut down and as such the pressure 
sensors attached to the PRUs are not active. 

The overall design concept of one pressure regulation unit is presented in Figure 4. Each PRU consists 
of four identical FPGA-based regulators, two for the serial solenoid valves of one MON branch and two 
regulators for the serial solenoid valves of one MMH branch. Each regulator is connected to a dedicated 
high pressure solenoid valve and receives commands from the VMC via the PDE and provides data to the 
VMC for monitoring using the same data link. Moreover, both PRUs house separate power supply for three 
pressure transducers per propellant side and for the two regulators of one branch, which allows individual 
powering and commanding of each pressurization branch. Once a PRU is powered on, each regulator can be 
put into an active mode, which gives the full functionality of pressure data acquisition and evaluation, valve 
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Figure 4. PFtU overall design and interface concept 


switching and data exchange with the VMC. A second mode, stand-by, gives all the functionality of an active 
mode, but automatic valve switching is inhibited. During nominal pressurization phases of a mission, the 
PRU channels controlling the active branch are in active mode, while the regulator channels of the redundant 
branch are put into stand-by mode. 

With its given design, the EPR allows to pressurize the MON and MMH propellant tanks independently 
to different pressure levels. The different pressure levels allow compensation of different initial pressure 
drops in the propellant network, compensation of different pressure drop evolutions due to draining of the 
upper propellant tanks and the serial lines (connection between upper and lower propellant tanks) and an 
adaptation of the mixture ratio for performance improvement. 

III.B. Bang-Bang Characteristics 

Using a bang-bang regulation concept, valves do not control pressure continuously like common mechanical 
pressure regulators. Instead, regulating valves behave approximately digital by either being fully open or 
fully closed (neglecting the opening and closing time). To control pressure in a pressure-fed system, mainly 
three values are needed. 

1. The current pressure in the propellant tank to be controlled, 

2. a target pressure, i.e., a set point, and 

3. a regulation bandwidth, which defines an upper and a lower threshold, at which the command to 
open/close the valve is triggered. 

When a control valve is open during a propulsive phase, pressure in the propellant tanks increases 
approximately linearly by p open , Figure 5. When the pressure is detected to be beyond the upper threshold, 
a control command is processed and the valves are commanded closed such that the pressure in the tank 
decreases approximately linearly by p c iosed due to continuous propellant consumption. When the pressure 
is detected to be below the lower threshold, a second control command is processed and the valves are 
commanded open and the cycle starts again. 

Due to this behavior, the maximum pressure bandwidth within the propellant tank during controlling is 
composed of the delta pressure between the upper and lower threshold plus the pressure deviations due to 
positive overshoot (A p+) and negative overshoot (A p—). 

While the thresholds are adjustable boundary conditions, the positive and negative overshot are a result 
of the regulation concept used, namely the sampling rate, which defines the maximum time after which 
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crossing thresholds is detected (A t samp u n g) plus the control loop time (A t con troi), which defines the time 
between detection of threshold crossing and fully opening/closing of the valves. 

III.C. Tank Pressure Evaluation 

The electrical pressure regulation controls the pressure of the propellant tank in dependence of measured 
pressure values at the tank inlet. Three independent pressure signals are used to determine a single weighted 
average pressure value, which is used for regulation. The pressure of three pressure transducers are evaluated 
with weights on each single measurement proportional to quadratic distance between remaining measure- 
ments according Equation 1. 


= Pi(P2 -P3) 2 +P2O1 -P3) 2 +P 3 (pi ~P2 ) 2 m 

PaV 9 (P2 ~ P3) 2 + (pi - P3) 2 + (Pi - P2) 2 

The function displays a weighted average that reduces the influence of outlier readings due to drifting, 
failed, or otherwise malfunctioning transducers. The weighting formula possesses a pole at p\ = P2 — P3- In 
this case, the PRU channel sets the average pressure value to the value of p\ . 

The effect of the weighting function on a single pressure transducer (PT) failure in terms of drifting is 
depicted in Figure 6. 



Figure 6. Behavior of weighted pressure value with one of three pressure values drifting 


While an arithmetic mean of all three pressure signals follows a PT drift with a factor of one third, the 
presented weighted pressure filters the offset of a single PT over the whole range. An increased pressure 
measurement uncertainty is limited to a small bandwidth of a systematic single PT offset. With the given 
overall characteristic, the weighting function can be regarded a two out of three voting function, which 
neglects the influence of a single pressure transducer that differs significantly from the remaining two pressure 
transducer values. 
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III.D. Tank Pressure Regulation 


The parameters for regulation are - beside the pressure signal - the set point and the regulation bandwidth, 
which are commanded by the VMC. The set point defines the demanded tank pressure value and the 
regulation bandwidth defines the upper and lower threshold. At a pressure value of the set point plus half 
the regulation bandwidth, i.e., at the upper threshold, the valve is commanded close. At a pressure value 
of the set point minus half the bandwidth, i.e., at the lower threshold, the valve is commanded open. The 
nominal set point in the propellant tank is set to obtain the nominal pressure of the OMS-E engine at its 
inlet taking into account all pressure losses between propellant tank and engine inlet. 

The regulation bandwidth depends on (1) the maximum allowable MON to MMH pressure deviation, (2) 
the pressure measurement inaccuracy and (3) the overshoots due to latency, Figure 7. The regulation band- 
width is determined as the allowable MON to MMH pressure deviation minus two times the measurement 
accuracy minus the positive and the negative overshoot. 



The positive overshoot, i.e., the pressure increase after the pressure reaches the upper threshold, depends 
on the latency time of the pressure acquisition/evaluation, the valve closing time and on the positive pressure 
gradient. 

The negative overshoot, i.e., the pressure decrease after the pressure reaches the lower threshold, depends 
on the latency time of the pressure acquisition/evaluation, the valve opening time and on the negative 
pressure gradient. 

The pressure gradient varies over the mission as it depends on the Helium mass flow (for positive gradient 
only), the propellant expulsion rate and the ullage volume. While the propellant expulsion rate and the 
consequent increase of ullage volume is defined by the thruster and OMS-E needs, the Helium mass flow rate 
is defined by the size of the flow limiting orifice. It controls the helium mass flow when the solenoid valves 
are in the open position. A single orifice is used to limit the initial mass flow, while concurrently allowing 
sufficient mass flow at the end of mission, when pressure and temperature in the helium tank is minimal. 
Assuming choked flow conditions with the orifice representing the critical cross sectional area of the PCA, 
the mass flow rate is given as function of the orifice’s cross sectional area A according to Equation 2. 




\ 


IPoPo 



( 2 ) 


Within the given design and boundary conditions, i.e., a pressure in the Helium vessel of approximately 
400 bar at ambient temperature conditions the maximum Helium mass flow rate at begin of a mission is in 
the order of 120 g/s, and at end of the mission the mass flow decreases to approximately 20 g/s. 

Due to the separate pressurization system for oxidizer and fuel, the pressure deviation between both 
propellant component tanks has to be limited in order to ensure a certain mixture ratio. With a bang-bang 
regulation concept, the maximum pressure deviation presents the maximum instantaneous pressure deviation 
rather than the effective/integral pressure deviation, Figure 8. The regulated pressure is controlled by the 
PRU based on the set point provided by VMC to each propellant side. This pressure corresponds to the 
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effective tank pressure. The maximum possible effective pressure deviation of the two tanks corresponds to 
two times the pressure measurement accuracy. 


Instantaneous MMH tank pressure 



IV. Operational Design 

In this chapter, the operational design of the EPR is presented, i.e., the operational logic for pressure 
conditioning prior and during a regulated boost phase is described. To receive an optimal fuel to oxidizer mix- 
ture ratio of 1.65, both propellant sides require approximately the same pressure values inside the propellant 
tanks. 

IV. A. Mode of Operation 

With electrical pressure regulation only needed during boost phases, where significant amounts of propellants 
are expulsed from the tanks, three basic modes of operation are defined. 

• A cruise mode, where no thruster / engine firing is performed and during which pressure regulation is 
powered-off 

• A re-pressurization mode, during which the propellant tanks are conditioned after a long duration 
cruise phase prior an active boost phase 

• An active pressurization mode, during which pressure regulation is fully active with thruster / engine 
firing. 

Cruise Mode 

During cruise mode the PRUs and thus regulation and data exchange between PRU and VMC is de- 
activated. Pressure monitoring is performed via the remaining two propellant tank pressure sensors per 
propellant side that are directly connected to the PDE. In case of deviation of the two sensors, a PRU 
will be switched on to receive additional pressure sensor readings, which allow to identify the failing sensor. 
Necessary attitude control maneuvers performed by any combination of RCS thrusters can be performed in 
blow down mode due to limited propellant expulsion rates and thus limited tank pressure drops. 

Different thermal behavior of MON and MMH lead to different pressure evolution in the propellant tanks 
during passive cruise phases with a higher increase of the MON pressure than the MMH pressure. This 
might lead to a violation of the operational domain of the main engine, such that prior each boost phase, a 
reconditioning of the propellant tank pressure will be performed. 

Re-pressurization Mode 

Pressure variations of the propellant tank due to thermal excursions during mission cruise phases require 
an adaptation of the regulation set point prior to a boost to bring the pressure ratio of MON and MMH back 
into the operational domain of the OMS-E engine, i.e., the pressure in the MON tank and the MMH tank 
need to be equalized. Since the EPR is only able to increase pressure by valve activation, but does not allow 
an active pressure release of one propellant side, both propellant tanks will be pressurized to the higher of 
both propellant pressures prior to a pressure regulated boost phase. After re-pressurization, the set point is 
set back to the nominal value. Thresholds are not being changed. The according logic is given in Figure 9. 
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Figure 9. Re-pressurization logic performed prior a boost phase 


After activation of the PRU, the pressure values for both propellants are evaluated and compared. If 
one value is larger than the other, the regulation set point for all regulator channels is set to the higher set 
point and regulation is activated. Consequently, only the solenoid valves of the tank with the lower tank 
pressure open, such that the established Helium mass flow increases the tank pressure. Upon reaching the 
upper threshold the solenoid valves close again with the pressures in both propellant tanks being on an 
equal level. Afterwards, the set point will be set to the nominal engine / thruster set point after which the 
boost phase can be initiated. If the nominal set point is below the current pressure level, thrusters / en- 
gine will operate in a blow down mode until the nominal pressure level is reached and active regulation sets in. 

Active Pressurization Mode 

For pressurization of a propellant tank during active boost phases, the solenoid valves of the PCA are 
commanded open/close by the PRU by evaluating tank pressure values and comparing them with an upper 
and lower threshold of a VMC commanded set point and regulation bandwidth. Besides providing set point 
and threshold prior to a regulation phase, VMC is not actively involved in the nominal pressurization process. 
Although possible, the baseline logic of set point and thresholds management is to not change their values 
during active pressure regulation. The corresponding nominal pressurization logic, which is carried out by 
each active PR.U regulation channel, is given in Figure 10. If the pressure level in the tanks is above the lower 
threshold, i.e. set point minus half the regulation bandwidth, the valves remain closed until the pressure 
reaches this lower threshold. Consequently, each bost starts with a limited blow down phase, the duration 
of which mainly depends on the initial tank pressure level. 

The overall concept including hot redundant serial valve activation based on the given pressure weight- 
ing function has already been successfully tested during development tests performed by Airbus DS at a 
Lampoldshausen test facility. Corresponding publication is planned in the near future. 

IV. B. Fault Detection, Isolation, and Recovery (FDIR) 

In order to maintain operation of active engine / thrusters, the propellant tank pressure is monitored and 
switching to the redundant pressurization branch will be performed before the pressure exceeds the oper- 
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Figure 10. Pressurization logic during a boost phase 


ational domain of the active engine during regulated boost phases. Due to the arrangement of two hot 
redundant solenoid valves in series, a single failure cannot lead to an over-pressurization of the propellant 
tank, but only to an underpressurization in case any active solenoid valve does not open. To be able to 
control the pressurization system and to be able to perform manual recovery in case of excess of the required 
failure tolerances, FDIR and safe limits are defined for PSS safing. All FDIR task will be performed and 
commanded centrally by the vehicle management computer (VMC) inside the crew module. 

Prior each actively regulated boost phase, the pressure of the propellant tank will be repressurized to 
at least the nominal set point. After initiation of a maneuver the regulation bandwidth allows a nominal 
pressure variation within +/-0.3 bar around the set point. 

Lower FDIR limit (under-pressurization) 

The lower FDIR limit in terms of tank pressure is set closely below the lower limits of the regulation 
domain, i.e. slightly below the lower regulation threshold including a defined margin. Consequently, if the 
propellant pressure decreases below this lower FDIR limit during a boost phase, an FDIR process within 
VMC is triggered to switch to the redundant branch (e.g., in case of a failed close solenoid valve) by isolating 
the first branch and activating the redundant branch thereafter. In case of a further failure, which leads to 
a pressure decrease or remaining pressure below the lower FDIR limit when already using the redundant 
branch, loss of pressurization capability is assumed and the VMC puts the propulsion system into a safe 
state with all thrusters shut down, the latch valves and solenoid valves of the PCA closed and the PRUs in 
stand-by mode for continuous data monitoring. Manual recovery with malfunction procedure is then to be 
performed by Ground. 

Upper FDIR limit (over-pressurization) 

After initiation of a maneuver and after initial blow down phase the regulation bandwidth allows a 
nominal pressure variation within +/-0.3 bar around the set point. After each initial blow down phase at the 
beginning of a boost the upper FDIR limit is set closely above the upper limit of the regulation domain, i.e. 
above the upper regulation threshold including a defined margin. Consequently, if the propellant pressure 
increases above this upper FDIR limit during a boost phase, the FDIR process within VMC is triggered to 
switch to the redundant branch by isolating the first branch and activating the redundant branch thereafter. 
Note, however, with two hot redundantly operating serial solenoid valves, the system is two fault tolerant 
against over-pressurization, e.g. over-pressurization can occur only after both serial solenoid valves fail to 
close. 
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V. Common Pressurization Mode 


In case of a failing pressurization function of one propellant side, e.g. caused by blockage of a PCA or 
external Helium leakage, a Helium cross feeding system is implemented in addition to the nominal pressur- 
ization system to bypass the nominal PCA of the failing propellant side in order to improve survivability 
of the crew. In the following sections, the common pressurization mode as part of the electrical pressure 
regulation system of the Orion MPCV European Service Module, is shortly described. A more extensive 
description of the system currently under development is planned for future publication. 

V.A. Layout Design 

The common pressurization system, also referred to as He X-feed, consists of three interlinking lines between 
the two propellant sides within the pressurization system, Figure 11. 



• A Helium cross feed line connecting the two Helium vessels upstream of the two PCAs 

• An MMH bypass line running from between the two solenoid valves of the redundant MON PCA 
branch to the MMH PCA, where it connects to the nominal PCA downstream of the junction of the 
nominal and the redundant regulation branch 

• A MON bypass line running from between the two solenoid valves of the redundant MMH PCA branch 
to the MON PCA, where it connects to the nominal PCA downstream of the junction of the nominal 
and the redundant regulation branch 

All lines will be activated by normally closed pyro valves. The two bypass lines each include two normally 
closed pyro valves, two helium filters, two latch valves, an additional flow limiting orifice, and corresponding 
test ports. In active regulation mode, all valves of the bypass line remain fully open. The overall mass flow is 
controlled by the solenoid valves of the redundant branch of the nominally working PCA, while equal mass 
flow distribution betweeen both propellant sides is realized by adjustment of the nominal and the He X-feed 
orifice. 

The tie in of the bypass lines between the two serial solenoid valves is realized based on results showing 
a propellant pumping effect if no regulating solenoid valve is located within the connection of the MON and 
the MMH tank as introduced by the bypass lines. 

The He X-feed orifice is located at the most upstream position of the bypass line. The positioning 
is based on results showing that after each solenoid valve closure during pressurization, the high pressure 
Helium between the solenoid valves and the orifices expands to tank pressure level leading to an additional 
pressurization of the propellant tanks. To avoid excessive pressure deviations between the actively controlled 
nominal side and the passively controlled failed side, it is mandatory to have approximately the same volumes 
between the regulating solenoid valves and the orifices (nominal PCA and He X-feed). 
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V.B. Mode of Operation 


The He X-feed system is designed to bypass a blockage of any of the two PCAs, or to re-establish pres- 
surization after the loss of any of the two Helium vessels caused by external leakage In all of these cases, 
not all cross feed lines will be activated by firing according pyro valves, but only part of the Helium cross 
feed system. The not-activated cross feed lines remain isolated. In total, four different activation modes 
are possible, two to bypass the MON side and two to bypass the MMH side. The Helium flow path and 
initial conditions leading to the corresponding activation mode when bypassing the MMH side are indicated 
in Figure 12. Due to its symmetrical setup, bypassing the MON side is performed in the same manner. 



X-feed mode: MMH1 

• Pressurization loss of MMH PCA 


X-feed mode: MMH2 

• Pressurization loss of MMH PCA 

• Both Helium vessels available 



■ ■ '■ Nominal PCA lines Branches not available Helium flow 

Figure 12. Activated states of the He X-feed system 



FDIR triggered: 

If loss of pressurization is 
detected PSS will be pot 
Into a safe state with all 
valves closed. 


VMC uses monitored 
pressure values for mode 
identification. 


NO automatic activation 
of He X-feed ! 


The general logic for determination of the Helium cross feed mode to be activated is displayed in Figure 13. 
The need for use of He X-feed is detected by a continuous pressure drop inside a propellant tank, which 
remains even after branch switching. FDIR will then automatically put the propulsion system into a safe 
state with all thrusters shut down, the latch valves and solenoid valves of the PCA closed and the PRUs in 
stand-by mode for continuous data monitoring. Follow-up monitoring of Helium vessel pressure data will 
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allow to identify the He X-feed mode to be activated, i.e. if only a single Helium vessel can be used, or if 
both vessels are available. The given logic only displays the logic on how to derive the correct He X-feed 
mode to be activated. The activation process itself, which is irreversible due to firing of normally closed 
pyro valves, will not to be performed automatically, but manually out of a defined PSS safe mode prior a 
regulated contingency phase. 


VI. Summary and Conclusion 

In this paper the current design of the pressurization system of the European Service Module for Orion 
MPCV was described. The system realizes an electrical bang-bang regulation concept on a separate pres- 
surization system for the two propellants MON-3 and MMH. The regulation algorithm, which uses a special 
weighting function mimicking a robust 2-out-of-3 voting, is implemented on service module level within a 
dedicated FPGA-based pressure regulation unit. Target values for regulation and FDIR task are commanded 
and controlled by MPCV’s central vehicle management computer located inside the crew module. 

The given design, which successfully passed the PDR milestone, allows flexible adaptations of the nominal 
regulation pressure to condition the propellants according to engine needs. The system is single fault tolerant 
against loss of pressurization capability and two fault tolerant against over-pressurization of the propulsion 
system. 

A common pressurization mode, He X-feed, is implemented in order to maintain pressurization capabilities 
in case of extended failures on a single propellant side to improve survivability of the crew. 

Feasibility of the pressurization concept has been demonstrated during development tests performed by 
Airbus DS at a Lampoldshausen test facility. 

Additional tests are to be performed until end of 2015 to further support a successful CDR of the overall 
ESM propulsion system thereafter. 
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